Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the application: 

Listing of Claims: 

1. (Previously presented) A method in a data processing system for dynamically protecting data 
from damage during execution of processes within the data processing system, the method comprising: 

joumaling the data to form joumaled data, wherein journaling the data comprises maintaining a 
system audit trail that contains activities occurring within the data processing system during the execution 
of the processes within the data processing system; 

dynamically determining whether a virus is present in the data processing system after journaling 
of the data has begun; and 

responsive to an identification of the virus, restoring the data using the joumaled data. 

2. (Original) The method of claim 1 further comprising: 

responsive to an absence of an identification of the virus, discarding the joumaled data. 

3. (Original) The method of claim 1, wherein the determining step comprises: 
performing pattern matching. 

4. (Previously presented) The method of claim 3, wherein the performing step includes: 
comparing a set of actions occurring within the data processing system with a set of known virus 

pattems. 

5. (Previously presented) The method of claim 1, wherein the data that is joumaled is located in a 
storage device external to the data processing system. 

6. (Original) The method of claim 1 further comprising: 

recording a sequence of actions occurring within the data processing system. 

7. (Previously presented) The method claim 1, wherein the data that is joumaled is data accessed by 
a process within the data processing system. 
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8. (Original) The method of claim 1 further comprising: 

responsive to an identification of the virus, blocking access to the data by a process accessing the 

data. 

9. (Original) The method of claim 1 further comprising: 

responsive to an identification of the virus, generating an indication halting a process accessing 
the data. 

10. (Previously presented) The method of claim 1, wherein the joumaled data is accessed by a single 
process and maintained until a determination is made that the single process is eliminated as a virus 
candidate. 

1 1 . (Original) The method of claim 1 , wherein the journaled data is stored in a protected memory 
accessible only by the method. 

12. (Previously presented) The method of claim 1 1 , wherein the journaled data is stored in a data 
structure located in a protected memory inaccessible by a process executing within the data processing 
system. 

13-23. (Cancelled) 

24. (Previously presented) A data processing system comprising: 
a bus system; 

a communications unit connected to the bus system; 

a memory connected to the bus system, wherein the memory includes as set of instructions; and 
a processing unit connected to the bus system, wherein the processing unit executes the set of 
instructions to journal the data to form joumaled data, wherein journal the data comprises maintaining a 
system audit trail that contains activities occurring within the data processing system during the execution 
of the processes within the data processing system; dynamically determines whether a virus is present in 
the data processing system after journal ing of the data has begun; and restores the data using the joumaled 
data in response to an identification of the virus. 

25. (Cancelled) 
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26. (Previously presented) A data processing system for dynamically protecting data from damage 
during execution of processes within the data processing system, the data processing system comprising: 

joumaling means for joumaling the data to form journaled data, wherein the joumaling means for 
joumaling the data comprises means for maintaining a system audit trail that contains activities occurring 
within the data processing system during the execution of the processes within the data processing 
system; 

determining means for dynamically determining whether a virus is present in the data processing 
system after joumaling of the data has begun; and 

restoring means, responsive to an identification of the virus, for restoring the data using the 
journaled data. 

27. (Original) The data processing system of claim 26 further comprising; 

discarding means, responsive to an absence of an identification of the virus, for discarding the 
journaled data. 

28. (Original) The data processing system of claim 26, wherein the determining means comprises: 
means for performing pattern matching. 

29. (Previously presented) The data processing system of claim 28, wherein the performing means 
includes: 

means for comparing a set of actions occurring within the data processing system with a set of 
known virus patterns. 

30. (Previously presented) The data processing system of claim 26, wherein the data that is journaled 
is located in a storage device external to the data processing system. 

3 1 . (Original) The data processing system of claim 26 further comprising: 

recording means for recording a sequence of actions occurring within the data processing system. 

32. (Previously presented) The data processing system claim 26, wherein the data that is journaled is 
data accessed by a process within the data processing system. 



Page 4 of 9 
Swimmer et al. - 09/865,246 



33. (Original) The data processing system of claim 26 further comprising: 

blocking means, responsive to an identification of the virus, for blocking access to the data by a 
process accessing the data, 

34. (Original) The data processing system of claim 26 further comprising: 

generating means, responsive to an identification of the virus, for generating an indication halting 
a process accessing the data. 

35. (Previously presented) The data processing system of claim 26, wherein the joumaled data is 
accessed by a single process and maintained until a determination is made that the single process is 
eliminated as a virus candidate. 

36. (Original) The data processing system of claim 26, wherein the joumaled data is stored in a 
protected memory accessible only by the method. 

37. (Previously presented) The data processing system of claim 36, wherein the joumaled data is 
stored in a data structure located in a protected memory inaccessible by the process executing within the 
data processing system. 

38-46. (Cancelled) 

47. (Previously presented) A computer program product in a computer readable medium for 
dynamically protecting data from damage during execution of processes within the data processing 
system, the computer program product comprising: 

first instructions for joumaling the data to form joumaled data, wherein joumaling the data 
comprises maintaining a system audit trail that contains activities occurring within the data processing 
system during the execution of the processes within the data processing system; 

second instructions for dynamically determining whether a virus is present in the data processing 
system after joumaling of the data has begun; and 

third instructions, responsive to an identification of the virus, for restoring the data using the 
joumaled data. 
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48. (Original) The computer program product of claim 47 further comprising: 

fourth instructions, responsive to an absence of an identification of the virus, for discarding the 
joumaled data. 

49. (Original) The computer program product of claim 47, wherein the second instructions 
comprises: 

sub-instructions for performing pattern matching. 

50. (Previously presented) The computer program product of claim 47, wherein the sub-instructions 
for performing includes: 

instructions for comparing a set of actions occurring within the data processing system with a set 
of known virus patterns, 

5 1 . (Previously presented) The computer program product of claim 47, wherein the data that is 
joumaled is located in a storage device external to the data processing system. 

52. (Original) The computer program product of claim 47 further comprising: 

fourth instructions for recording a sequence of actions occurring within the data processing 

system. 

53. (Previously presented) The computer program product claim 47, wherein the data that is 
joumaled is data accessed by a process within the data processing system. 

54. (Original) The computer program product of claim 47 further comprising: 

fourth instructions, responsive to an identification of the virus, for blocking access to the data by 
a process accessing the data. 

55. (Original) The computer program product of claim 47 further comprising: 

fourth instructions, responsive to an identification of the virus, for generating an indication 
halting a process accessing the data. 

56. (Previously presented) The computer program product of claim 47, wherein the joumaled data is 
accessed by a single process and maintained until a determination is made that the single process is 
eliminated as a vims candidate. 
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57. (Original) The computer program product of claim 47, wherein the joumaled data is stored in a 
protected memory accessible only by the method. 

58. (Previously presented) The computer program product of claim 57, wherein the joumaled data is 
stored in a data structure located in a protected memory inaccessible by the process executing within the 
data processing system. 

59-67, (Cancelled) 
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